security criteria